WO2023042098A1 - Amélioration de la sécurité contre les fausses stations de base - Google Patents

Amélioration de la sécurité contre les fausses stations de base Download PDF

Info

Publication number
WO2023042098A1
WO2023042098A1 PCT/IB2022/058673 IB2022058673W WO2023042098A1 WO 2023042098 A1 WO2023042098 A1 WO 2023042098A1 IB 2022058673 W IB2022058673 W IB 2022058673W WO 2023042098 A1 WO2023042098 A1 WO 2023042098A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
secret
processor
paging
network
Prior art date
Application number
PCT/IB2022/058673
Other languages
English (en)
Inventor
Prateek Basu Mallick
Joachim Löhr
Andreas Kunz
Ravi Kuchibhotla
Hyung-Nam Choi
Original Assignee
Lenovo (Singapore) Pte. Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Lenovo (Singapore) Pte. Ltd. filed Critical Lenovo (Singapore) Pte. Ltd.
Priority to CN202280061983.2A priority Critical patent/CN117941396A/zh
Publication of WO2023042098A1 publication Critical patent/WO2023042098A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices

Definitions

  • the subject matter disclosed herein relates generally to wireless communications and more particularly relates to enhancing security against false base stations.
  • base stations provide a mobile device, such as a user equipment (“UE”) device, access to a mobile network. Fake or false base stations may be used to deny services to a UE, attack a UE, provide rogue services to a UE, and/or the like.
  • UE user equipment
  • a first apparatus includes a transceiver and a processor that is coupled to the transceiver.
  • the processor is configured to cause the apparatus to connect to a base station of a mobile wireless communication network, verify an authenticity of the connected base station while in an inactive state, and disconnect from the connected base station in response to the authenticity of the connected base station failing.
  • a first method connects to a base station of a mobile wireless communication network, verifies an authenticity of the connected base station while in an inactive state, and disconnects from the connected base station in response to the authenticity of the connected base station failing.
  • a second apparatus includes a transceiver and a processor that is coupled to the transceiver.
  • the processor is configured to cause the apparatus to determine a set of time occasions for transmission of a secret paging message to a UE, the secret paging message for verifying an authenticity of a base station, transmit, to the UE, an indication of the set of time occasions for transmission of the secret paging message, and trigger transmission of the secret paging message to the UE during a time occasion of the set of time occasions.
  • a second method determines a set of time occasions for transmission of a secret paging message to a UE, the secret paging message for verifying an authenticity of a base station, transmits, to the UE, an indication of the set of time occasions for transmission of the secret paging message, and triggers transmission of the secret paging message to the UE during a time occasion of the set of time occasions.
  • Figure 1 is a schematic block diagram illustrating one embodiment of a wireless communication system for enhancing security against false base stations
  • FIG. 2 shows a general diagram of the radio coverage of a genuine base station where a UE is camped on (in radio resource control (“RRC”) Idle or Inactive state) or connected to (in RRC Connected state) a fake base station;
  • RRC radio resource control
  • Figure 3 shows a procedure for sending a secret paging occasion (“s-PO”) configuration to a UE in a secure session and receiving a secret paging (“s-paging”);
  • s-PO secret paging occasion
  • Figure 4 shows a procedure for sending an s-PO configuration to a UE in a secure session and not receiving an s-paging
  • Figure 5 shows a procedure for sending an s-PO configuration to a UE in a secure session using a secret service temporary mobile subscriber identity (“S-TMSI”) instead of an s- paging;
  • S-TMSI secret service temporary mobile subscriber identity
  • Figure 6 is a diagram illustrating one embodiment of a NR protocol stack
  • Figure 7 is a block diagram illustrating one embodiment of a user equipment apparatus that may be used for enhancing security against false base stations
  • Figure 8 is a block diagram illustrating one embodiment of a network apparatus that may be used for enhancing security against false base stations
  • Figure 9 is a flowchart diagram illustrating one embodiment of a method for enhancing security against false base stations.
  • Figure 10 is a flowchart diagram illustrating one embodiment of a method for enhancing security against false base stations.
  • embodiments may be embodied as a system, apparatus, method, or program product. Accordingly, embodiments may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects.
  • the disclosed embodiments may be implemented as a hardware circuit comprising custom very-large-scale integration (“VLSI”) circuits or gate arrays, off-the- shelf semiconductors such as logic chips, transistors, or other discrete components.
  • VLSI very-large-scale integration
  • the disclosed embodiments may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, or the like.
  • the disclosed embodiments may include one or more physical or logical blocks of executable code which may, for instance, be organized as an object, procedure, or function.
  • embodiments may take the form of a program product embodied in one or more computer readable storage devices storing machine readable code, computer readable code, and/or program code, referred hereafter as code.
  • the storage devices may be tangible, non-transitory, and/or non -transmission.
  • the storage devices may not embody signals. In a certain embodiment, the storage devices only employ signals for accessing code.
  • the computer readable medium may be a computer readable storage medium.
  • the computer readable storage medium may be a storage device storing the code.
  • the storage device may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, holographic, micromechanical, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing.
  • a storage device More specific examples (a non-exhaustive list) of the storage device would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random-access memory (“RAM”), a read-only memory (“ROM”), an erasable programmable read-only memory (“EPROM” or Flash memory), a portable compact disc read-only memory (“CD-ROM”), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
  • a computer readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device.
  • Code for carrying out operations for embodiments may be any number of lines and may be written in any combination of one or more programming languages including an object-oriented programming language such as Python, Ruby, Java, Smalltalk, C++, or the like, and conventional procedural programming languages, such as the “C” programming language, or the like, and/or machine languages such as assembly languages.
  • the code may execute entirely on the user’s computer, partly on the user’s computer, as a stand-alone software package, partly on the user’s computer and partly on a remote computer or entirely on the remote computer or server.
  • the remote computer may be connected to the user’s computer through any type of network, including a local area network (“LAN”), wireless LAN (“WLAN”), or a wide area network (“WAN”), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider (“ISP”)).
  • LAN local area network
  • WLAN wireless LAN
  • WAN wide area network
  • ISP Internet Service Provider
  • a list with a conjunction of “and/or” includes any single item in the list or a combination of items in the list.
  • a list of A, B and/or C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C or a combination of A, B and C.
  • a list using the terminology “one or more of’ includes any single item in the list or a combination of items in the list.
  • one or more of A, B and C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C or a combination of A, B and C.
  • a list using the terminology “one of’ includes one and only one of any single item in the list.
  • “one of A, B and C” includes only A, only B or only C and excludes combinations of A, B and C.
  • a member selected from the group consisting of A, B, and C includes one and only one of A, B, or C, and excludes combinations of A, B, and C ”
  • “a member selected from the group consisting of A, B, and C and combinations thereof’ includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C or a combination of A, B and C.
  • the code may also be stored in a storage device that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the storage device produce an article of manufacture including instructions which implement the function/act specified in the flowchart diagrams and/or block diagrams.
  • the code may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the code which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart diagrams and/or block diagrams.
  • each block in the flowchart diagrams and/or block diagrams may represent a module, segment, or portion of code, which includes one or more executable instructions of the code for implementing the specified logical function(s).
  • the functions noted in the block may occur out of the order noted in the Figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. Other steps and methods may be conceived that are equivalent in function, logic, or effect to one or more blocks, or portions thereof, of the illustrated Figures.
  • the present disclosure describes systems, methods, and apparatuses for enhancing security against false base stations.
  • the methods may be performed using computer code embedded on a computer-readable medium.
  • an apparatus or system may include a computer-readable medium containing computer-readable code which, when executed by a processor, causes the apparatus or system to perform at least a portion of the below described solutions.
  • a fake (false) base station may be a cause of various problems in a mobile network, such as:
  • DoS Denial of Service
  • Rogue services which attempt to deliver unauthorized or unsolicited services (e.g., SMS and calls) to the UE.
  • an RRC Idle or Inactive state UE first needs to detect that it is camped on an FBS. This subject matter herein discloses means to achieve this and further provides means to get rid of an FBS.
  • This disclosure first describes methods by which the UE can first suspect that it is served by an FBS and then go on to determine if it is really served by the FBS.
  • An interesting concept of secret paging, among other solutions, is disclosed whereby only the UE and the access and mobility management function (“AMF”) knows that the UE needs to be deterministically paged within a certain time window.
  • AMF access and mobility management function
  • the concept of secret paging is further improved to tackle increased physical downlink control channel (“PDCCH”) blocking probability.
  • PDCCH physical downlink control channel
  • This embodiment uses a secret S-TMSI instead of the s-POs in the third embodiment.
  • the secret-S-TMSI is provided to the UE using non-access stratum (“NAS”) signaling when (or subsequently after) performing one of the NAS procedures e.g., registration or registration area update procedure.
  • NAS non-access stratum
  • the UE may beforehand or alongside (e.g., in a registration request) indicate its capability to detect an FBS and/or its need to avoid an FBS.
  • the core network may provide the UE with a secret S-TMSI, which is different from the received S- TMSI.
  • the secret S-TMSI could be allocated as part of an allocated secret-global unique temporary identifier (“GUTI”).
  • GUI secret-global unique temporary identifier
  • presence of this secret-S-TMSI in the RRC paging message provides an indication that the UE is on a genuine gNB.
  • s-paging is still done in the POs, e.g.., s-POs may not be necessary per se.
  • Figure 1 depicts a wireless communication system 100 supporting enhancing security against false base stations, according to embodiments of the disclosure.
  • the wireless communication system 100 includes at least one remote unit 105, a radio access network (“RAN”) 120, and a mobile core network 130.
  • the RAN 120 and the mobile core network 130 form a mobile communication network.
  • the RAN 120 may be composed of a base unit 121 with which the remote unit 105 communicates using wireless communication links 115.
  • remote units 105 Even though a specific number of remote units 105, base units 121, wireless communication links 115, RANs 120, and mobile core networks 130 are depicted in Figure 1, one of skill in the art will recognize that any number of remote units 105, base units 121, wireless communication links 115, RANs 120, and mobile core networks 130 may be included in the wireless communication system 100.
  • the RAN 120 is compliant with the 5G system specified in the Third Generation Partnership Project (“3GPP”) specifications.
  • the RAN 120 may be a New Generation Radio Access Network (“NG-RAN”), implementing NR RAT and/or 3GPP Long-Term Evolution (“LTE”) RAT.
  • the RAN 120 may include non- 3GPP RAT (e.g., Wi-Fi® or Institute of Electrical and Electronics Engineers (“IEEE”) 802.11- family compliant WLAN).
  • the RAN 120 is compliant with the LTE system specified in the 3GPP specifications.
  • the wireless communication system 100 may implement some other open or proprietary communication network, for example Worldwide Interoperability for Microwave Access (“WiMAX”) or IEEE 802. 16-family standards, among other networks.
  • WiMAX Worldwide Interoperability for Microwave Access
  • IEEE 802. 16-family standards among other networks.
  • the present disclosure is not intended to be limited to the implementation of any particular wireless communication system architecture or protocol.
  • the remote units 105 may include computing devices, such as desktop computers, laptop computers, personal digital assistants (“PDAs”), tablet computers, smart phones, smart televisions (e.g., televisions connected to the Internet), smart appliances (e.g., appliances connected to the Internet), set-top boxes, game consoles, security systems (including security cameras), vehicle on-board computers, network devices (e.g., routers, switches, modems), or the like.
  • the remote units 105 include wearable devices, such as smart watches, fitness bands, optical head-mounted displays, or the like.
  • the remote units 105 may be referred to as the UEs, subscriber units, mobiles, mobile stations, users, terminals, mobile terminals, fixed terminals, subscriber stations, user terminals, wireless transmit/receive unit (“WTRU”), a device, or by other terminology used in the art.
  • the remote unit 105 includes a subscriber identity and/or identification module (“SIM”) and the mobile equipment (“ME”) providing mobile termination functions (e.g., radio transmission, handover, speech encoding and decoding, error detection and correction, signaling and access to the SIM).
  • SIM subscriber identity and/or identification module
  • ME mobile equipment
  • the remote unit 105 may include a terminal equipment (“TE”) and/or be embedded in an appliance or device (e.g., a computing device, as described above).
  • the remote units 105 may communicate directly with one or more of the base units 121 in the RAN 120 via uplink (“UL”) and downlink (“DL”) communication signals. Furthermore, the UL and DL communication signals may be carried over the wireless communication links 123.
  • the RAN 120 is an intermediate network that provides the remote units 105 with access to the mobile core network 130.
  • the remote units 105 communicate with an application server via a network connection with the mobile core network 130.
  • an application 107 e.g., web browser, media client, telephone and/or Voice-over-Intemet-Protocol (“VoIP”) application
  • VoIP Voice-over-Intemet-Protocol
  • a remote unit 105 may trigger the remote unit 105 to establish a protocol data unit (“PDU”) session (or other data connection) with the mobile core network 130 via the RAN 120.
  • the mobile core network 130 then relays traffic between the remote unit 105 and the application server (e.g., the content server 151 in the packet data network 150) using the PDU session.
  • the PDU session represents a logical connection between the remote unit 105 and the User Plane Function (“UPF”) 131.
  • UPF User Plane Function
  • the remote unit 105 To establish the PDU session (or PDN connection), the remote unit 105 must be registered with the mobile core network 130 (also referred to as ‘“attached to the mobile core network” in the context of a Fourth Generation (“4G”) system). Note that the remote unit 105 may establish one or more PDU sessions (or other data connections) with the mobile core network 130. As such, the remote unit 105 may have at least one PDU session for communicating with the packet data network 150, e.g., representative of the Internet. The remote unit 105 may establish additional PDU sessions for communicating with other data networks and/or other communication peers.
  • the mobile core network 130 also referred to as ‘“attached to the mobile core network” in the context of a Fourth Generation (“4G”) system.
  • the remote unit 105 may establish one or more PDU sessions (or other data connections) with the mobile core network 130.
  • the remote unit 105 may have at least one PDU session for communicating with the packet data network 150, e.g., representative of the Internet.
  • PDU Session a data connection that provides end-to-end (“E2E”) user plane (“UP”) connectivity between the remote unit 105 and a specific Data Network (“DN”) through the UPF 131.
  • E2E end-to-end
  • DN Data Network
  • a PDU Session supports one or more Quality of Service (“QoS”) Flows.
  • QoS Quality of Service
  • EPS Evolved Packet System
  • PDN Packet Data Network
  • the PDN connectivity procedure establishes an EPS Bearer, i.e., atunnel between the remote unit 105 and a Packet Gateway (“PGW”, not shown) in the mobile core network 130.
  • PGW Packet Gateway
  • QCI QoS Class Identifier
  • the base units 121 may be distributed over a geographic region.
  • a base unit 121 may also be referred to as an access terminal, an access point, a base, a base station, a Node-B (“NB”), an Evolved Node B (abbreviated as eNodeB or “eNB,” also known as Evolved Universal Terrestrial Radio Access Network (“E-UTRAN”) Node B), a 5G/NR Node B (“gNB”), a Home Node-B, a relay node, a RAN node, or by any other terminology used in the art.
  • NB Node-B
  • eNB Evolved Node B
  • gNB 5G/NR Node B
  • the base units 121 are generally part of a RAN, such as the RAN 120, that may include one or more controllers communicably coupled to one or more corresponding base units 121. These and other elements of radio access network are not illustrated but are well known generally by those having ordinary skill in the art.
  • the base units 121 connect to the mobile core network 130 via the RAN 120.
  • the base units 121 may serve a number of remote units 105 within a serving area, for example, a cell or a cell sector, via a wireless communication link 123.
  • the base units 121 may communicate directly with one or more of the remote units 105 via communication signals.
  • the base units 121 transmit DL communication signals to serve the remote units 105 in the time, frequency, and/or spatial domain.
  • the DL communication signals may be carried over the wireless communication links 123.
  • the wireless communication links 123 may be any suitable carrier in licensed or unlicensed radio spectrum.
  • the wireless communication links 123 facilitate communication between one or more of the remote units 105 and/or one or more of the base units 121. Note that during NR-U operation, the base unit 121 and the remote unit 105 communicate over unlicensed radio spectrum.
  • the mobile core network 130 is a 5GC or an Evolved Packet Core (“EPC”), which may be coupled to a packet data network 150, like the Internet and private data networks, among other data networks.
  • a remote unit 105 may have a subscription or other account with the mobile core network 130.
  • Each mobile core network 130 belongs to a single public land mobile network (“PLMN”).
  • PLMN public land mobile network
  • the mobile core network 130 includes several network functions (“NFs”). As depicted, the mobile core network 130 includes at least one UPF 131.
  • the mobile core network 130 also includes multiple control plane (“CP”) functions including, but not limited to, an AMF 133 that serves the RAN 120, a Session Management Function (“SMF”) 135, a Network Exposure Function (“NEF”), a Policy Control Function (“PCF”) 137, a Unified Data Management function (“UDM”) and a User Data Repository (“UDR”) 139.
  • CP control plane
  • the UPF(s) 131 is responsible for packet routing and forwarding, packet inspection, QoS handling, and external PDU session for interconnecting Data Network (“DN”), in the 5G architecture.
  • the AMF 133 is responsible for termination of NAS signaling, NAS ciphering & integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management.
  • the SMF 135 is responsible for session management (i.e., session establishment, modification, release), remote unit (i.e., UE) IP address allocation & management, DL data notification, and traffic steering configuration for UPF for proper traffic routing.
  • the NEF is responsible for making network data and resources easily accessible to customers and network partners. Service providers may activate new capabilities and expose them through APIs. These APIs allow third-party authorized applications to monitor and configure the network’s behavior for a number of different subscribers (i.e., connected devices with different applications).
  • the PCF 137 is responsible for unified policy framework, providing policy rules to CP functions, access subscription information for policy decisions in UDR.
  • the UDM is responsible for generation of Authentication and Key Agreement (“AKA”) credentials, user identification handling, access authorization, subscription management.
  • AKA Authentication and Key Agreement
  • the UDR is a repository of subscriber information and can be used to service a number of network functions.
  • the UDR may store subscription data, policy-related data, subscriber-related data that is permitted to be exposed to third party applications, and the like.
  • the UDM is co-located with the UDR, depicted as combined entity “UDM/UDR” 139.
  • the mobile core network 130 may also include an Authentication Server Function (“AUSF”) (which acts as an authentication server), a Network Repository Function (“NRF”) (which provides NF service registration and discovery, enabling NFs to identify appropriate services in one another and communicate with each other over Application Programming Interfaces (“APIs”)), or other NFs defined for the 5GC.
  • AUSF Authentication Server Function
  • NRF Network Repository Function
  • the mobile core network 130 may include an authentication, authorization, and accounting (“AAA”) server.
  • AAA authentication, authorization, and accounting
  • the mobile core network 130 supports different types of mobile data connections and different types of network slices, wherein each mobile data connection utilizes a specific network slice.
  • a “network slice” refers to a portion of the mobile core network 130 optimized for a certain traffic type or communication service.
  • a network instance may be identified by a single-network slice selection assistance information (“S-NSSAI,”) while a set of network slices for which the remote unit 105 is authorized to use is identified by network slice selection assistance information (“NSSAI”).
  • S-NSSAI single-network slice selection assistance information
  • NSSAI network slice selection assistance information
  • NSSAI refers to a vector value including one or more S-NSSAI values.
  • the various network slices may include separate instances of network functions, such as the SMF 135 and UPF 131.
  • the different network slices may share some common network functions, such as the AMF 133.
  • the different network slices are not shown in Figure 1 for ease of illustration, buttheir support is assumed.
  • the mobile core network 130 may include a Network Slice Selection Function (“NSSF”) which is responsible for selecting of the Network Slice instances to serve the remote unit 105, determining the allowed NSSAI, determining the AMF set to be used to serve the remote unit 105.
  • NSSF Network Slice Selection Function
  • the depicted network functions may be replaced with appropriate EPC entities, such as a Mobility Management Entity (“MME”), a Serving Gateway (“SGW”), a PGW, a Home Subscriber Server (“HSS”), and the like.
  • MME Mobility Management Entity
  • SGW Serving Gateway
  • PGW Packet Data Network Gateway
  • HSS Home Subscriber Server
  • the AMF 133 may be mapped to an MME
  • the SMF 135 may be mapped to a control plane portion of a PGW and/or to an MME
  • the UPF 131 may be mapped to an SGW and a user plane portion of the PGW
  • the UDM/UDR 139 may be mapped to an HSS, etc.
  • Figure 1 depicts components of a 5G RAN and a 5G core network
  • the described embodiments apply to other types of communication networks and RATs, including IEEE 802. 11 variants, Global System for Mobile Communications (“GSM”, i.e., a 2G digital cellular network), General Packet Radio Service (“GPRS”), UMTS, LTE variants, CDMA 2000, Bluetooth, ZigBee, Sigfox, and the like.
  • GSM Global System for Mobile Communications
  • GPRS General Packet Radio Service
  • UMTS Universal Mobile communications
  • LTE variants Long Term Evolution
  • CDMA 2000 Code Division Multiple Access 2000
  • Bluetooth ZigBee
  • ZigBee ZigBee
  • Sigfox and the like.
  • gNB is used for the base station but it is replaceable by any other radio access node, e.g., RAN node, eNB, Base Station (“BS”), Access Point (“AP”), NR, etc. Further the operations are described mainly in the context of 5G NR. However, the proposed solutions/methods are also equally applicable to other mobile communication systems supporting enhancing security against false base stations.
  • Figure 2 shows a general diagram of the radio coverage of a genuine BS 202 where a UE 206 is camped, in RRC Idle or Inactive state, or connected to, in RRC Connected state, an FBS 204 supposing that it is on the genuine BS 202.
  • the UE’s 206 trust comes by virtue of absence of suspicion that the UE 206 may be on an FBS 204.
  • Various embodiments described herein help the UE 206 determine if it is on an FBS 204.
  • an FBS 204 is defined as a radio base station that can replay some or all broadcast messages including synchronization codes publishing a cell identity, master information block (“MIB”), system information block 1 (“SIB1”), or the like.
  • MIB master information block
  • SIB1 system information block 1
  • An FBS 204 may or may not have the capability to reproduce every single common DL message (like Paging) or dedicated DL message in a timely manner (real-time or almost in real-time).
  • a UE implementation where a UE from time to time e.g., using a timer of, for example, 100 seconds, determines if it is camped on a genuine base station.
  • the necessity to verify authenticity of camped base station may also be configured by the network e.g., as part of the UE’s registration, an AMF may configure the UE to periodically verify e.g., using a configured timer that its camped base station is genuine.
  • some events can be defined and configured by the network (core network or a genuine radio network when such configuration is sent protected using RRC Connected Security keys).
  • the events could be defined around a sudden change of radio condition e.g., when the UE would rather expect deteriorating reference signal received power (“RSRP”) (when moving from cell centre to cell edge) but suddenly it measures an ‘x’ dB increase in the base station’s signal power resulting in a ‘V’ curve for signal (e.g., SSB) measurements.
  • RSRP reference signal received power
  • the UE may conclude the cell as an FBS only if the physical cell ID (“PCI”) and Cellldentity, as broadcasted in SIB 1 of the cell, has not changed before and after the sudden change of radio quality.
  • PCI physical cell ID
  • Cellldentity as broadcasted in SIB 1 of the cell
  • the UE stores PCI and Cellldentity information and verifies, when a ‘V’ curve for signal (e.g., SSB) measurements occurs if the PCI and Cellidentity remain the same, after acquiring these afresh. If yes, the UE concludes that it is on an FBS; otherwise, the UE does not take any new action since it is on a new genuine cell. Accordingly, the first embodiment enables the UE to suspect the camped base station.
  • SSB signal
  • a suspecting UE can verify its serving gNB by attempting to go to RRC Connected state and doing a normal bi-directional authentication.
  • the UE determines that it is camped on an FBS if one of more of the following occurs:
  • Timer T300 (or T301 or T319) runs out
  • s-paging is done by the network (e.g., AMF, gNB) at s-POs that are either:
  • the s-POs provided by the AMF to the UE may be a list of POs and may be refreshed once the AMF recognizes the last POs of the list are approaching.
  • the s-paging is done “deterministically,” e.g., there’s a guarantee that UE shall be s-paged by a genuine network.
  • the guarantee may stand for every s- paging occasion or in a time window. In the latter case, the UE knows that the next s-paging must be received within certain time after receiving an s-paging.
  • the time window could be absolute, e.g., in seconds or in a number of the UE’s discontinuous reception (“DRX”) cycles.
  • DRX discontinuous reception
  • the time window concept makes it further difficult for an observer to trace occurrences of PagingRecord/ue-Identity (e.g., as defined in 3GPP TS 38.331) since the network can randomize such occurrences.
  • an s-paging configuration (s-POs directly or factors leading to calculation of s-POs) is sent (see messaging 305) to UE 302 in a secured session e.g., after UE 302 is registered and security is active.
  • the AMF 306 decides to secretly page the UE 302, it provides (see messaging 310) the POs (or time window) to the gNB 304 that may be used to send the paging message to the UE 302.
  • gNB 304 does not need to calculate the POs of the UE 302, e.g., as described in 3GPP TS 38.304, but rather follow the instruction of the AMF 306 and include the S-TMSI as a PagingRecord inside an RRC Paging message (see messaging 315).
  • the AMF 306 may have configured the UE 302 to monitor secret paging in the first 5 ms. at the start of every 100 ms., where the time starts at the SFN#0, subframe#0 of the serving gNB 304, or the like. So, in this example, 5 ms. occurring periodically every 100 ms. refer to the the POs.
  • the s-PO configuration may also include a time window where the UE 302 is guaranteed to receive at least one s-Page. Extending the example, if the time window is 10 seconds, then the UE 302 receives an s-Page at least once in any of the s-POs. The UE 302 need not respond to s-paging
  • the s-paging can be turned off by network in zero-threat areas and can be turned on when/where required. Since it is optional and based on the network/UE’s threat perception, the extra paging monitoring should not be a hindrance to implement or use.
  • optimizations can be achieved where the network uses the s-paging to also page the UE.
  • the s-paging may lead to a higher PDCCH blocking probability.
  • some measures (or a combination thereof) can be taken:
  • the concept of s-paging is further enhanced to tackle increased PDCCH blocking probability.
  • This embodiment uses a secret-S-TMSI instead of the s- POs in the embodiment above.
  • the secret-S-TMSI may be provided to the UE using NAS signaling when (or subsequently after) performing one of the NAS procedures e.g., service request, registration, or registration area update procedure.
  • the UE may beforehand/or alongside (e.g., in a registration request) need to indicate its capability to detect FBS and/or its need to avoid FBS.
  • the CN e.g., AMF
  • the secret-S-TMSI could be allocated as part of an allocated secret-GUTI.
  • presence of this secret-S-TMSI in the RRC paging message provides an indication that the UE 502 is on a genuine gNB 504.
  • s-Paging is still done in the POs, e.g., the s-POs are not necessary per se, as shown in Figure 5.
  • This embodiment also has the benefit that the secret paging is transparent to gNB 504 e.g., the gNB 504 need not know that the secret-S-TMSI is any different from any of the other (normal) S-TMSIs.
  • one implementation of this embodiment may benefit from the s-POs concept disclosed in the previous embodiment.
  • the network only guarantees that there will be a secret-S- TMSI at least once in ‘x’ DRX Cycles (or equivalent ‘y’ seconds) and thereby the network randomizes the presence of the secret-S-TMSI in POs to avoid an attacker tracing the presence of possible secret-S-TMSI(s). Since aPagingUE-Identity is 48 bits (NG-5G-S-TMSI) or 40 bits (I- RNTI -Value) long, there’s no shortage of such identities.
  • a secret-S-TMSI or secret-inactive -radio network temporary identifier (“RNTI”)-Value is allocated by the AMF or the gNB respectively using secured e.g., security activated) signaling.
  • RNTI secret-inactive -radio network temporary identifier
  • the gNB needs to page the UE with s-paging if the AMF has conveyed that a certain UE need be paged secretly from time to time.
  • the AMF may independently inform this to the serving gNB of an RRC Connected UE or may inform the gNB when the gNB informs the AMF that a certain UE is transitioning to RRC Inactive state.
  • the normal S-TMSI is used but changed for each of the s- POs, e.g., the S-TMSI is concatenated with a shared secret value in the UE and the AMF, e.g., subscription concealed identifier (“SUCI”), subscription permanent identifier (“SUPI”), K am f, Knas-enc, Knas-im, UL NAS COUNT, DL NAS COUNT, and/or the like, and then the combined string is hashed with a hash function, e.g., SHA-256 and truncated at the most or least significant bits e.g., to 40 bits or 48 bits. The truncated value may then be used for the next PO as a secret S- TMSI.
  • SUCI subscription concealed identifier
  • SUPI subscription permanent identifier
  • K am f Knas-enc
  • Knas-im Knas-im
  • UL NAS COUNT DL
  • the concept of secret paging as in the previous embodiments is used, but instead of secret-S-TMSI, it uses an s-RNTI for s-Paging. This still contributes to higher PDCCH blocking rate and the network side solutions described previously needs to be used.
  • the UE is assigned a secret paging group that is only known to the UE and network entities, such as the AMF or a genuine base station.
  • RAN2 discussed UE paging based on subgrouping as part of the Rel-17 work on UE power saving enhancement to reduce power consumption in the UE due to false paging alarms. This is done by further dividing the UEs within a paging occasion into multiple subgroups.
  • CN-assigned subgrouping There are two subgrouping approaches, in one embodiment, namely CN-assigned subgrouping and UEID-based subgrouping.
  • the CN e.g., AMF
  • the AMF assigns a secret subgroup ID to a UE e.g., this subgroup may be signalled in addition to the “normal” subgroup identity.
  • some protected NAS signaling message should be supported between the AMF and the UE to convey the related information to the UE.
  • the secret paging subgroup could be used to indicate to a UE that the base station is a genuine base station if the UE is deterministically paged at least once in a configured time window. As already outlined in other embodiments, the UE need not respond to the paging on the secret paging subgroup. In one specific implementation, the UE reads the paging downlink control information (“DCI”) to verify a genuine base station:
  • DCI paging downlink control information
  • the UE • if the UE did not receive one or more paging on an s-paging subgroup within a certain time window, e.g., not once in ‘x’ occurrences of the paging occasions for the secret subgroup, it knows that it is on an FBS
  • the paging on a secret paging subgroup may be done “deterministically,” e.g., there’s a guarantee that the UE will be s-paged by a genuine network.
  • the guarantee may stand for every paging occasion corresponding to the secret aging subgroup or in a time window. In the latter case, the UE knows that the next paging must be received within a certain time after receiving a paging.
  • the secret paging subgroup is further used to determine an s-paging occasion, which is only known to genuine network entities and the UE.
  • a driving point for another embodiment is to make the FBS process the DL e.g., by making it difficult for it to perform a simple replay. This can be done by overlaying a genuine gNB (as shown in Figure 2) by broadcasting a 1 -bit flag when it suspects an FBS presence.
  • the suspicion of a presence of an FBS can be based on:
  • gNB could depend on the network data analytics function (“NWDAF”) for this;
  • • gNB may use its own reference UEs.
  • the FBS just replays everything, it will also make aware the UEs connecting to/camping on it that there may be an FBS and the UEs can then first verify the authenticity of the current gNB by establishing RRC Connection and subsequently security procedure. When failing, UEs move away (to another frequency) and perform security procedure. Since this will potentially impact many UEs, including those served by the genuine cell, a more phased manner of RRC Connection establishment can be used e.g., by using/configuring different sets of access identities/access categories for this purpose.
  • a network uses more than one of the solutions disclosed herein. This has the following benefits:
  • the network can choose one of the disclosed techniques on a per UE basis e.g., different UEs across the cell are configured to use different FBS detection technique.
  • an embodiment discloses a remedy that can be applied as soon as the UE determines that UE is on an FBS. Upon such detection UE releases RRC connection (if RRC Connected), moves to RRC Idle and initiates Inter-frequency reselection procedure, and then try to go to RRC Connected (and perform a normal bi-directional authentication). As an enhanced feature, the reselection rules are changed, and the conventional radio based reselections do not apply in such a case. Instead, as the first possibility, the UE considers the current cell/frequency as barred for at least a predetermined/preconfigured time. As a second possibility, the UE considers the current frequency to be of lowest absolute frequency priority.
  • the radio condition of this frequency is deemed as lowest, triggering reselection to any other lower/higher priority frequency, irrespective of actual measurement values of the said frequency.
  • a new Report- FBS-and-Authentication procedure can be designed, whereby the UE shares details of the FBS (e.g., physical location, frequency, cell Id, measurement values, or the like).
  • Figure 6 depicts a NR protocol stack 600, according to embodiments of the disclosure. While Figure 6 shows the remote unit 105, the base unit 121 and the mobile core network 130, these are representative of a set of UEs interacting with a RAN node and a NF (e.g., AMF) in a core network. As depicted, the protocol stack 600 comprises a User Plane protocol stack 605 and a Control Plane protocol stack 610.
  • a NR protocol stack 600 comprises a User Plane protocol stack 605 and a Control Plane protocol stack 610.
  • the User Plane protocol stack 605 includes a physical (“PHY”) layer 615, a Medium Access Control (“MAC”) sublayer 620, a Radio Link Control (“RLC”) sublayer 625, a Packet Data Convergence Protocol (“PDCP”) sublayer 630, and Service Data Adaptation Protocol (“SDAP”) sublayer 635.
  • the Control Plane protocol stack 610 also includes a physical layer 615, a MAC sublayer 620, a RLC sublayer 625, and a PDCP sublayer 630.
  • the Control Place protocol stack 610 also includes a Radio Resource Control (“RRC”) sublayer and a Non-Access Stratum (“NAS”) sublayer 645.
  • RRC Radio Resource Control
  • NAS Non-Access Stratum
  • the AS protocol stack for the Control Plane protocol stack 610 consists of at least RRC, PDCP, RLC and MAC sublayers, and the physical layer.
  • the AS protocol stack for the User Plane protocol stack 605 consists of at least SDAP, PDCP, RLC and MAC sublayers, and the physical layer.
  • the Layer-2 (“L2”) is split into the SDAP, PDCP, RLC and MAC sublayers.
  • the Layer-3 (“L3”) includes the RRC sublayer 640 and the NAS sublayer 645 for the control plane and includes, e.g., an Internet Protocol (“IP”) layer or PDU Layer (note depicted) for the user plane.
  • IP Internet Protocol
  • LI and L2 are referred to as “lower layers” such as PUCCH/PUSCH or MAC CE, while L3 and above (e.g., transport layer, application layer) are referred to as “higher layers” or “upper layers” such as RRC.
  • the physical layer 615 offers transport channels to the MAC sublayer 620.
  • the MAC sublayer 620 offers logical channels to the RLC sublayer 625.
  • the RLC sublayer 625 offers RLC channels to the PDCP sublayer 630.
  • the PDCP sublayer 630 offers radio bearers to the SDAP sublayer 635 and/or RRC sublayer 640.
  • the SDAP sublayer 635 offers QoS flows to the mobile core network 130 (e.g., 5GC).
  • the RRC sublayer 640 provides for the addition, modification, and release of Carrier Aggregation and/or Dual Connectivity.
  • the RRC sublayer 640 also manages the establishment, configuration, maintenance, and release of Signaling Radio Bearers (“SRBs”) and Data Radio Bearers (“DRBs”).
  • SRBs Signaling Radio Bearers
  • DRBs Data Radio Bearers
  • a RRC entity functions for detection of and recovery from radio link failure.
  • FIG. 7 depicts a user equipment apparatus 700 that may be used for enhancing security against false base stations, according to embodiments of the disclosure.
  • the user equipment apparatus 700 is used to implement one or more of the solutions described above.
  • the user equipment apparatus 700 may be one embodiment of a UE, such as the remote unit 105 and/or the UE 205, as described above.
  • the user equipment apparatus 700 may include a processor 705, a memory 710, an input device 715, an output device 720, and a transceiver 725.
  • the input device 715 and the output device 720 are combined into a single device, such as a touchscreen.
  • the user equipment apparatus 700 may not include any input device 715 and/or output device 720.
  • the user equipment apparatus 700 may include one or more of: the processor 705, the memory 710, and the transceiver 725, and may not include the input device 715 and/or the output device 720.
  • the transceiver 725 includes at least one transmitter 730 and at least one receiver 735.
  • the transceiver 725 communicates with one or more base units 121.
  • the transceiver 725 may support at least one network interface 740 and/or application interface 745.
  • the application interface(s) 745 may support one or more APIs.
  • the network interface(s) 740 may support 3 GPP reference points, such as Uu and PC5. Other network interfaces 740 may be supported, as understood by one of ordinary skill in the art.
  • the processor 705, in one embodiment, may include any known controller capable of executing computer-readable instructions and/or capable of performing logical operations.
  • the processor 705 may be a microcontroller, a microprocessor, a central processing unit (“CPU”), a graphics processing unit (“GPU”), an auxiliary processing unit, a field programmable gate array (“FPGA”), a digital signal processor (“DSP”), a coprocessor, an application-specific processor, or similar programmable controller.
  • the processor 705 executes instructions stored in the memory 710 to perform the methods and routines described herein.
  • the processor 705 is communicatively coupled to the memory 710, the input device 715, the output device 720, and the transceiver 725.
  • the processor 705 may include an application processor (also known as “main processor”) which manages application-domain and operating system (“OS”) functions and a baseband processor (also known as “baseband radio processor”) which manages radio functions.
  • an application processor also known as “main processor” which manages application
  • the memory 710 in one embodiment, is a computer readable storage medium.
  • the memory 710 includes volatile computer storage media.
  • the memory 710 may include a RAM, including dynamic RAM (“DRAM”), synchronous dynamic RAM (“SDRAM”), and/or static RAM (“SRAM”).
  • the memory 710 includes non-volatile computer storage media.
  • the memory 710 may include a hard disk drive, a flash memory, or any other suitable non-volatile computer storage device.
  • the memory 710 includes both volatile and non-volatile computer storage media.
  • the memory 710 stores data related to CSI enhancements for higher frequencies.
  • the memory 710 may store parameters, configurations, resource assignments, policies, and the like as described above.
  • the memory 710 also stores program code and related data, such as an operating system or other controller algorithms operating on the user equipment apparatus 700, and one or more software applications.
  • the input device 715 may include any known computer input device including a touch panel, a button, a keyboard, a stylus, a microphone, or the like.
  • the input device 715 may be integrated with the output device 720, for example, as a touchscreen or similar touch-sensitive display.
  • the input device 715 includes a touchscreen such that text may be input using a virtual keyboard displayed on the touchscreen and/or by handwriting on the touchscreen.
  • the input device 715 includes two or more different devices, such as a keyboard and a touch panel.
  • the output device 720 in one embodiment, is designed to output visual, audible, and/or haptic signals.
  • the output device 720 includes an electronically controllable display or display device capable of outputting visual data to a user.
  • the output device 720 may include, but is not limited to, an LCD display, an LED display, an OLED display, a projector, or similar display device capable of outputting images, text, or the like to a user.
  • the output device 720 may include a wearable display separate from, but communicatively coupled to, the rest of the user equipment apparatus 700, such as a smart watch, smart glasses, a heads-up display, or the like.
  • the output device 720 may be a component of a smart phone, a personal digital assistant, a television, a table computer, a notebook (laptop) computer, a personal computer, a vehicle dashboard, or the like.
  • the output device 720 includes one or more speakers for producing sound.
  • the output device 720 may produce an audible alert or notification (e.g., a beep or chime).
  • the output device 720 includes one or more haptic devices for producing vibrations, motion, or other haptic feedback.
  • all or portions of the output device 720 may be integrated with the input device 715.
  • the input device 715 and output device 720 may form a touchscreen or similar touch-sensitive display.
  • the output device 720 may be located near the input device 715.
  • the transceiver 725 includes at least transmitter 730 and at least one receiver 735.
  • the transceiver 725 may be used to provide UL communication signals to a base unit 121 and to receive DL communication signals from the base unit 121, as described herein. Similarly, the transceiver 725 may be used to transmit and receive SL signals (e.g., V2X communication), as described herein. Although only one transmitter 730 and one receiver 735 are illustrated, the user equipment apparatus 700 may have any suitable number of transmitters 730 and receivers 735. Further, the transmitters) 730 and the receiver(s) 735 may be any suitable type of transmitters and receivers. In one embodiment, the transceiver 725 includes a first transmitter/receiver pair used to communicate with a mobile communication network over licensed radio spectrum and a second transmitter/receiver pair used to communicate with a mobile communication network over unlicensed radio spectrum.
  • the first transmitter/receiver pair used to communicate with a mobile communication network over licensed radio spectrum and the second transmitter/receiver pair used to communicate with a mobile communication network over unlicensed radio spectrum may be combined into a single transceiver unit, for example a single chip performing functions for use with both licensed and unlicensed radio spectrum.
  • the first transmitter/receiver pair and the second transmitter/receiver pair may share one or more hardware components.
  • certain transceivers 725, transmitters 730, and receivers 735 may be implemented as physically separate components that access a shared hardware resource and/or software resource, such as for example, the network interface 740.
  • one or more transmitters 730 and/or one or more receivers 735 may be implemented and/or integrated into a single hardware component, such as a multi -transceiver chip, a system -on-a-chip, an ASIC, or other type of hardware component.
  • one or more transmitters 730 and/or one or more receivers 735 may be implemented and/or integrated into a multi -chip module.
  • other components such as the network interface 740 or other hardware components/circuits may be integrated with any number of transmitters 730 and/or receivers 735 into a single chip.
  • the transmitters 730 and receivers 735 may be logically configured as a transceiver 725 that uses one more common control signals or as modular transmitters 730 and receivers 735 implemented in the same hardware chip or in a multi -chip module.
  • the processor 705 is configured to connect to a base station of a mobile wireless communication network, verify an authenticity of the connected base station while in an inactive state, and disconnect from the connected base station in response to the authenticity of the connected base station failing.
  • the processor 705 is configured to monitor for a secret paging message from the connected base station, during an occasion, to verify the authenticity of the connected base station.
  • the processor 705 is configured to receive an indication of the occasion in a protected NAS message.
  • the processor 705 is configured to monitor paging, based on the protected NAS message, at an offset relative to a paging occasion.
  • the occasion comprises an absolute time, or a number of discontinuous reception cycles, or some combination thereof.
  • the processor 705 is configured to cease monitoring for the secret paging message in response to the apparatus being within an area with a threat level that satisfies a threat level threshold.
  • the processor 705 is configured to receive standard paging messages from the connected base station using the secret paging message.
  • the processor 705 is configured to receive a secret S-TMSI from a network entity for verifying the authenticity of the connected base station.
  • the processor 705 is configured to monitor for the secret S- TMSI in paging messages to verify the authenticity of the connected base station.
  • the processor 705 is configured to receive the secret S-TMSI during a paging occasion of the apparatus’s regular paging occasions.
  • the processor 705 is configured to receive the secret S-TMSI in a protected NAS message at least once within a time window.
  • the inactive state is one of an RRC idle state and an RRC inactive state.
  • FIG. 8 depicts one embodiment of a network apparatus 800 that may be used for enhancing security against false base stations, according to embodiments of the disclosure.
  • the network apparatus 800 may be one embodiment of a RAN node and its supporting hardware, such as the base unit 121 and/or gNB, described above.
  • network apparatus 800 may include a processor 805, a memory 810, an input device 815, an output device 820, and a transceiver 825.
  • the network apparatus 800 does not include any input device 815 and/or output device 820.
  • the transceiver 825 includes at least one transmitter 830 and at least one receiver 835.
  • the transceiver 825 communicates with one or more remote units 105. Additionally, the transceiver 825 may support at least one network interface 840 and/or application interface 845.
  • the application interface(s) 845 may support one or more APIs.
  • the network interface(s) 840 may support 3GPP reference points, such as Uu, Nl, N2, N3, N5, N6 and/or N7 interfaces. Other network interfaces 840 may be supported, as understood by one of ordinary skill in the art.
  • the processor 805, in one embodiment, may include any known controller capable of executing computer-readable instructions and/or capable of performing logical operations.
  • the processor 805 may be a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, an FPGA, a DSP, a co-processor, an application-specific processor, or similar programmable controller.
  • the processor 805 executes instructions stored in the memory 810 to perform the methods and routines described herein.
  • the processor 805 is communicatively coupled to the memory 810, the input device 815, the output device 820, and the transceiver 825.
  • the processor 805 may include an application processor (also known as “main processor”) which manages application-domain and OS functions and a baseband processor (also known as “baseband radio processor”) which manages radio function.
  • the processor 805 controls the network apparatus 800 to implement the above described network entity behaviors (e.g., of the gNB) for enhancing security against false base stations.
  • the memory 810 in one embodiment, is a computer readable storage medium.
  • the memory 810 includes volatile computer storage media.
  • the memory 810 may include a RAM, including DRAM, SDRAM, and/or SRAM.
  • the memory 810 includes non-volatile computer storage media.
  • the memory 810 may include a hard disk drive, a flash memory, or any other suitable non-volatile computer storage device.
  • the memory 810 includes both volatile and nonvolatile computer storage media.
  • the memory 810 stores data relating to CSI enhancements for higher frequencies.
  • the memory 810 may store parameters, configurations, resource assignments, policies, and the like as described above.
  • the memory 810 also stores program code and related data, such as an OS or other controller algorithms operating on the network apparatus 800, and one or more software applications.
  • the input device 815 may include any known computer input device including a touch panel, a button, a keyboard, a stylus, a microphone, or the like.
  • the input device 815 may be integrated with the output device 820, for example, as a touchscreen or similar touch -sensitive display.
  • the input device 815 includes a touchscreen such that text may be input using a virtual keyboard displayed on the touchscreen and/or by handwriting on the touchscreen.
  • the input device 815 includes two or more different devices, such as a keyboard and a touch panel.
  • the output device 820 may include any known electronically controllable display or display device.
  • the output device 820 may be designed to output visual, audible, and/or haptic signals.
  • the output device 820 includes an electronic display capable of outputting visual data to a user.
  • the output device 820 may be a component of a smart phone, a personal digital assistant, a television, a table computer, a notebook (laptop) computer, a personal computer, a vehicle dashboard, or the like.
  • the output device 820 includes one or more speakers for producing sound.
  • the output device 820 may produce an audible alert or notification (e.g., a beep or chime).
  • the output device 820 includes one or more haptic devices for producing vibrations, motion, or other haptic feedback.
  • all or portions of the output device 820 may be integrated with the input device 815.
  • the input device 815 and output device 820 may form atouchscreen or similar touch-sensitive display. In other embodiments, all or portions of the output device 820 may be located near the input device 815.
  • the transceiver 825 may communicate with one or more remote units and/or with one or more interworking functions that provide access to one or more PLMNs.
  • the transceiver 825 may also communicate with one or more network functions (e.g., in the mobile core network 80).
  • the transceiver 825 operates under the control of the processor 805 to transmit messages, data, and other signals and also to receive messages, data, and other signals.
  • the processor 805 may selectively activate the transceiver (or portions thereof) at particular times in order to send and receive messages.
  • the transceiver 825 may include one or more transmitters 830 and one or more receivers 835.
  • the one or more transmitters 830 and/or the one or more receivers 835 may share transceiver hardware and/or circuitry.
  • the one or more transmitters 830 and/or the one or more receivers 835 may share antenna(s), antenna tuner(s), amplifier(s), filter(s), oscillator(s), mixer(s), modulator/demodulator(s), power supply, and the like.
  • the transceiver 825 implements multiple logical transceivers using different communication protocols or protocol stacks, while using common physical hardware.
  • the processor 805 is configured to determine a set of time occasions for transmission of a secret paging message to a UE, the secret paging message for verifying an authenticity of a base station, transmit an indication of the set of time occasions for transmission of the secret paging message, and trigger transmission of the secret paging message to the UE during a time occasion of the set of time occasions.
  • the processor 805 is configured to generate a secret S-TMSI for the UE, the S-TMSI for verifying the authenticity of the base station.
  • the processor 805 is configured to transmit a secret paging configuration to the UE during a secured session between the apparatus and the UE, the secret paging configuration indicating the set of time occasions, the secret S-TMSI, or both.
  • Figure 9 is a flowchart diagram of a method 900 for enhancing security against false base stations.
  • the method 900 may be performed by a UE as described herein, for example, the remote unit 105 and/or the user equipment apparatus 700.
  • the method 900 may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.
  • the method 900 begins and connects 905 to a base station of a mobile wireless communication network. In one embodiment, the method 900 verifies 910 an authenticity of the connected base station while in an inactive state. In one embodiment, the method 900 disconnects 915 from the connected base station in response to the authenticity of the connected base station failing, and the method 900 ends.
  • Figure 10 is a flowchart diagram of a method 1000 for enhancing security against false base stations.
  • the method 1000 may be performed by a network entity as described herein, for example, a network function, a base station, and/or the network equipment apparatus 800.
  • the method 1000 may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.
  • the method 1000 begins and determines 1005 a set of time occasions for transmission of a secret paging message to a user equipment ("UE"), the secret paging message for verifying an authenticity of a base station.
  • the method 1000 transmits 1010, to the UE, an indication of the set of time occasions for transmission of the secret paging message.
  • the method 1000 triggers 1015 transmission of the secret paging message to the UE during a time occasion of the set of time occasions, and the method 1000 ends.
  • a first apparatus is disclosed for enhancing security against false base stations.
  • the first apparatus may include a UE as described herein, for example, the remote unit 105 and/or the user equipment apparatus 700.
  • the first apparatus includes a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.
  • the first apparatus includes a transceiver and a processor that is coupled to the transceiver.
  • the processor is configured to cause the apparatus to connect to a base station of a mobile wireless communication network, verify an authenticity of the connected base station while in an inactive state, and disconnect from the connected base station in response to the authenticity of the connected base station failing.
  • the processor is configured to cause the apparatus to monitor for a secret paging message from the connected base station, during an occasion, to verify the authenticity of the connected base station.
  • the processor is configured to cause the apparatus to receive an indication of the occasion in a protected NAS message.
  • the processor is configured to cause the apparatus to monitor paging, based on the protected NAS message, at an offset relative to a paging occasion.
  • the occasion comprises an absolute time, or a number of discontinuous reception cycles, or some combination thereof.
  • the processor is configured to cause the apparatus to cease monitoring for the secret paging message in response to the apparatus being within an area with a threat level that satisfies a threat level threshold.
  • the processor is configured to cause the apparatus to receive standard paging messages from the connected base station using the secret paging message.
  • the processor is configured to cause the apparatus to receive a secret S-TMSI from a network entity for verifying the authenticity of the connected base station.
  • the processor is configured to cause the apparatus to monitor for the secret S-TMSI in paging messages to verify the authenticity of the connected base station.
  • the processor is configured to cause the apparatus to receive the secret S-TMSI during a paging occasion of the apparatus’s regular paging occasions.
  • the processor is configured to cause the apparatus to receive the secret S-TMSI in a protected NAS message at least once within a time window.
  • the inactive state is one of an RRC idle state and an RRC inactive state.
  • a first method is disclosed for enhancing security against false base stations.
  • the first method may be performed by a UE as described herein, for example, the remote unit 105 and/or the user equipment apparatus 700.
  • the first method may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.
  • the first method connects to abase station of a mobile wireless communication network, verifies an authenticity of the connected base station while in an inactive state, and disconnects from the connected base station in response to the authenticity of the connected base station failing.
  • the first method monitors for a secret paging message from the connected base station, during an occasion, to verify the authenticity of the connected base station.
  • the first method receives an indication of the occasion in a protected NAS message.
  • the first method monitors paging, based on the protected NAS message, at an offset relative to a paging occasion.
  • the occasion comprises an absolute time, or a number of discontinuous reception cycles, or some combination thereof.
  • the first method ceases monitoring for the secret paging message in response to the apparatus being within an area with a threat level that satisfies a threat level threshold.
  • the first method receives standard paging messages from the connected base station using the secret paging message.
  • the first method receives a secret S-TMSI from a network entity for verifying the authenticity of the connected base station.
  • first method monitors for the secret S-TMSI in paging messages to verify the authenticity of the connected base station.
  • the first method receives the secret S-TMSI during a paging occasion of the apparatus’s regular paging occasions.
  • the first method receives the secret S-TMSI in a protected NAS message at least once within a time window.
  • the inactive state is one of an RRC idle state and an RRC inactive state.
  • a second apparatus is disclosed for enhancing security against false base stations.
  • the second apparatus may include a network entity as described herein, for example, a network function, a base station, and/or the network equipment apparatus 800.
  • the second apparatus may include a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.
  • the second apparatus includes a transceiver and a processor that is coupled to the transceiver.
  • the processor is configured to cause the apparatus to determine a set of time occasions for transmission of a secret paging message to a UE, the secret paging message for verifying an authenticity of a base station, transmit, to the UE, an indication of the set of time occasions for transmission of the secret paging message, and trigger transmission of the secret paging message to the UE during a time occasion of the set of time occasions.
  • the processor is configured to cause the apparatus to generate a secret S-TMSI for the UE, the S-TMSI for verifying the authenticity of the base station.
  • the processor is configured to cause the apparatus to transmit a secret paging configuration to the UE during a secured session between the apparatus and the UE, the secret paging configuration indicating the set of time occasions, the secret S-TMSI, or both.
  • a second method for enhancing security against false base stations.
  • the second method may be performed by a network entity as described herein, for example, a network function, a base station, and/or the network equipment apparatus 800.
  • the second method may be performed by a processor executing program code, for example, a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.
  • the second method determines a set of time occasions for transmission of a secret paging message to a UE, the secret paging message for verifying an authenticity of a base station, transmits, to the UE, an indication of the set of time occasions for transmission of the secret paging message, and triggers transmission of the secret paging message to the UE during a time occasion of the set of time occasions.
  • the second method generates a secret S-TMSI for the UE, the S-TMSI for verifying the authenticity of the base station.
  • the second method transmits a secret paging configuration to the UE during a secured session between the apparatus and the UE, the secret paging configuration indicating the set of time occasions, the secret S-TMSI, or both.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne des appareils, des procédés et des systèmes permettant d'améliorer la sécurité contre les fausses stations de base. Un appareil (700) comprend un émetteur-récepteur (725) et un processeur (705) qui est couplé à l'émetteur-récepteur (725). Le processeur (705) est configuré pour amener l'appareil (700) à se connecter à une station de base d'un réseau de communication sans fil mobile, à vérifier l'authenticité de la station de base connectée tandis qu'elle est dans un état inactif, et à se déconnecter de la station de base connectée en réponse à l'échec d'authenticité de la station de base connectée.
PCT/IB2022/058673 2021-09-15 2022-09-14 Amélioration de la sécurité contre les fausses stations de base WO2023042098A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202280061983.2A CN117941396A (zh) 2021-09-15 2022-09-14 增强针对假基站的安全性

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US202163244629P 2021-09-15 2021-09-15
US63/244,629 2021-09-15

Publications (1)

Publication Number Publication Date
WO2023042098A1 true WO2023042098A1 (fr) 2023-03-23

Family

ID=83508701

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/IB2022/058673 WO2023042098A1 (fr) 2021-09-15 2022-09-14 Amélioration de la sécurité contre les fausses stations de base

Country Status (2)

Country Link
CN (1) CN117941396A (fr)
WO (1) WO2023042098A1 (fr)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180270786A1 (en) * 2017-03-17 2018-09-20 Alcatel-Lucent Usa Inc. Protection of privacy in paging of user equipment
WO2020112292A1 (fr) * 2018-11-30 2020-06-04 Qualcomm Incorporated Procédés et systèmes de détection et de réponse à des attaques de canal de radiomessagerie

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180270786A1 (en) * 2017-03-17 2018-09-20 Alcatel-Lucent Usa Inc. Protection of privacy in paging of user equipment
WO2020112292A1 (fr) * 2018-11-30 2020-06-04 Qualcomm Incorporated Procédés et systèmes de détection et de réponse à des attaques de canal de radiomessagerie

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
3GPP TS 38.304
3GPP TS 38.331
LENOVO ET AL: "Detection of MitM attacks with secret paging", vol. SA WG3, no. e-meeting ;20220627 - 20220701, 20 June 2022 (2022-06-20), XP052195913, Retrieved from the Internet <URL:https://ftp.3gpp.org/tsg_sa/WG3_Security/TSGS3_107e-AdHoc/Docs/S3-221572.zip S3-221572_Mitm.doc> [retrieved on 20220620] *

Also Published As

Publication number Publication date
CN117941396A (zh) 2024-04-26

Similar Documents

Publication Publication Date Title
US20230098840A1 (en) Measurement configuration for non-public radio cell
WO2023002454A1 (fr) Configuration de mobilité basée sur un groupe
US20230292326A1 (en) Dci format that indicates to monitor for paging dci
US20230413360A1 (en) Disabling a pending nssai
US20230136693A1 (en) Enabling roaming with authentication and key management for applications
EP4190057A1 (fr) Gestion de radiomessagerie
WO2023042098A1 (fr) Amélioration de la sécurité contre les fausses stations de base
US20230319780A1 (en) Receiving collected data from a group of devices
US20230300725A1 (en) Acquiring on-demand system information
US20240032147A1 (en) Configuration for logging mbs measurements
US20240147574A1 (en) User equipment power saving for v2x communications
US20240196468A1 (en) Keeping a terminal in a connected state while the terminal is away from a communication network
US20230422341A1 (en) Configuring discontinuous reception for pc5 interface
US20230319545A1 (en) Dynamic user equipment identifier assignment
US20240129845A1 (en) Data connection establishment in response to a disaster condition
US20230198716A1 (en) Parallel transmission of segmented rrc messages
WO2022009179A1 (fr) Gestion de radiomessagerie pour de multiples modules d&#39;identité d&#39;abonné universels
WO2022009177A1 (fr) Gestion de radiomessagerie pour de multiples modules d&#39;identités d&#39;abonnés universels
WO2023126909A1 (fr) Prise en charge d&#39;appel vocal dans des systèmes de communication sans fil
WO2023047381A1 (fr) Rapport de faisceaux de détection et association avec des faisceaux de transmission pour une procédure lbt
WO2023139558A1 (fr) Détermination de temporisateurs de connexion de liaison latérale pour établir une communication via un relais de liaison latérale
WO2023067502A1 (fr) Sélection de ressources tenant compte de drx de liaison latérale
EP4385276A1 (fr) Procédure d&#39;émission/réception sur liaison descendante pour transmissions de petites données

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22783019

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202280061983.2

Country of ref document: CN

NENP Non-entry into the national phase

Ref country code: DE